search

TremoloSecurity / MyVirtualDirectory

Open Source LDAP Virtual Directory
Apache License 2.0
45 stars 18 forks source link

myVD config over Weblogic Not Working #16

Closed ShivankSiemens closed 7 years ago

ShivankSiemens commented 7 years ago

@mlbiam Hello Marc,

It seems we still have not resolved the Weblogic configuration. When we tried to change the config file for our production system, we are not able to search the main service account user. (Similar to the problem we had in Primavera.)

So we had to defer the myVD deployment.

I think, we will need one more session to figure out the problem in setup.

Pls. advise.

Thanks, Shivank

ShivankSiemens commented 7 years ago

myvd.log.07122016.txt

ShivankSiemens commented 7 years ago

@mlbiam I have attached the logs.

It seems the login is not at all possible with the account mentioned in myVD config file.

Can you pls. check and advise asap.

Thanks, Shivank

mlbiam commented 7 years ago

@ShivankSiemens can you please provide your config and the name of the user you are trying to login with?

mlbiam commented 7 years ago

@ShivankSiemens also, please provide me your latest test environment configuration so I can compare them.

ShivankSiemens commented 7 years ago

@mlbiam PFA the config file we are using for weblogic.

If possible can you pls. send a meeting invite now. Me and my offshore team mate are available.

We can go through the issue and then you can do the analysis offline as well.

Thanks, Shivank

ShivankSiemens commented 7 years ago

config.xml.07122016.txt

ShivankSiemens commented 7 years ago

user I am trying to login with is 'bw12primaz' and 'saxen01s'

mlbiam commented 7 years ago

@ShivankSiemens I'm sorry but your organization has decided not to purchase commercial support so we're going to have to work together via the community support forums here on Github

mlbiam commented 7 years ago

I meant the MyVD configuration, not the weblogic configuration. Also, have you made sure you are able to find users via a standard LDAP client?

ShivankSiemens commented 7 years ago

myvd.conf07122016.txt

ShivankSiemens commented 7 years ago

yes.. these users.. we can search in LDAP client when we start myVD. Problem is When configuring myVD in weblogic and start the server.. We are not able to login into the application. It is not accepting any domain credentials

ShivankSiemens commented 7 years ago

I am not sure on commercial support thing. So can not comment upon that as of now. Will check internally.

mlbiam commented 7 years ago

@ShivankSiemens ok, so if we're able to search and bind correctly through LDAP then the issue is in weblogic. I don't see anything in the config that looks wrong. Is there anything in the weblogic logs? Are there any differences between the test and prod weblogic config?

ShivankSiemens commented 7 years ago

I don't think it is binding as well because login is not possible with the user mentioned in myVD config file. We are using the exact same weblogic configuration as earlier.

pls., check logs.

The user that we are able to search from LDAP client because myVD server is running. But configuration over weblogic is not working correctly to bind user.

ShivankSiemens commented 7 years ago

AdminServer.log.txt bi_server1-diagnostic.log.txt bipublisher.log.txt myvd.log.txt

ShivankSiemens commented 7 years ago

@mlbiam I have generated fresh log files for each - myVD, weblogic admin server, managed server, application

Can you please check and advise.

Thanks, Shivank

mlbiam commented 7 years ago

@ShivankSiemens Looking through the MyVD logs I'm seeing several successful searches and bind operations:

bw12primaz - search and bind weblogic - search, no results OracleSystemUser - search, no results

The only thing that looks out of the ordinary is that group searches are using groupofnames instead of groupOfUniqueNames so no groups will resolve.

Looking in bi_server1-diagnostic I see its complaining about an identity not being found but its not saying which identity is the problem. My best guess is its looking for the OracleSystemUser and can't find it in either AD. Should this user exist in AD? if not, then it sounds like the identity needs to be created locally in weblogic's internal userstore or it needs to be created in one of the AD forests.

mlbiam commented 7 years ago

@ShivankSiemens checking in, how did things go?

ShivankSiemens commented 7 years ago

@mlbiam Yes he user exist in AD. Since a web confrenece is not feasible. We are now investigating on our own.

It seems to me an issue with SSL/certificates on the servers for production and non-prod.

If by changing that today, it works - then I think we are good to go. Will let you know later.

Thanks, Shivank

mlbiam commented 7 years ago

@ShivankSiemens checking to see if you were able to find the cert issues

ShivankSiemens commented 7 years ago

Hi @mlbiam Yes we were able to sort out that issue.

Thanks for your support.

Regards, Shivank